diff --git a/gp-okta.conf b/gp-okta.conf
index ac1b828..d1e3b69 100644
--- a/gp-okta.conf
+++ b/gp-okta.conf
@@ -10,7 +10,7 @@ totp.google = ABCDEFGHIJKLMNOP
 gateway = Manual ny1-gw.example.com
 #cert = path-to-client-cert-as-unencrypted-pem-file.pem
 #openconnect_cmd = sudo openconnect
-openconnect_args =                    # optional arguments to openconnect, probably you might want to repeat the cert here (if used above) with --certificate=xxx
+openconnect_args =                    # optional arguments to openconnect
 execute = 0                           # execute openconnect command
 another_dance = 0                     # second round of authentication required
 bug.nl = 0                            # newline work-around for openconnect
diff --git a/gp-okta.py b/gp-okta.py
index 76c929d..7ddde29 100755
--- a/gp-okta.py
+++ b/gp-okta.py
@@ -490,6 +490,8 @@ def main():
 	cmd = conf.get('openconnect_cmd') or 'openconnect'
 	cmd += ' --protocol=gp -u \'{0}\''
 	cmd += ' --usergroup {1}'
+	if conf.get('cert'):
+		cmd += ' --certificate=\'{0}\''.format(conf.get('cert'))
 	cmd += ' --passwd-on-stdin ' + conf.get('openconnect_args', '') + ' \'{2}\''
 	cmd = cmd.format(username, cookie_type, conf.get('vpn_url'))
 	gw = (conf.get('gateway') or '').strip()